Ubuntu.comUB:CVE-2017-5630CVE-2017-5630
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.015 Low
EPSS
Percentile
87.1%
PECL in the download utility class in the Installer in PEAR Base System
v1.10.1 does not validate file types and filenames after a redirect, which
allows remote HTTP servers to overwrite files via crafted responses, as
demonstrated by a .htaccess overwrite.
Bugs
Notes
| Author | Note |
|---|---|
| sbeattie | PEAR issues should go against php-pear as of xenial |
| seth-arnold | PEAR/PECL appears to have no authenticity checks of any sort. As far as I can tell any malicious MITM can install whatever they want anyway. |
| leosilva | unfixed as of 2020-11-23 |
| rodrigo-zaiden | unfixed as of 2022-03-08. |
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.015 Low
EPSS
Percentile
87.1%